2 * Copyright notice from original mutt:
3 * Copyright (C) 1999-2000 Brendan Cully <brendan@kublai.com>
5 * This file is part of mutt-ng, see http://www.muttng.org/.
6 * It's licensed under the GNU General Public License,
7 * please see the file GPL in the top level source directory.
10 /* GSS login/authentication code */
12 #include <lib-lib/lib-lib.h>
16 #include <netinet/in.h>
19 # include <gssapi/gssapi.h>
20 # define gss_nt_service_name GSS_C_NT_HOSTBASED_SERVICE
22 # include <gssapi/gssapi.h>
23 # include <gssapi/gssapi_generic.h>
26 #define GSS_BUFSIZE 8192
28 #define GSS_AUTH_P_NONE 1
29 #define GSS_AUTH_P_INTEGRITY 2
30 #define GSS_AUTH_P_PRIVACY 4
33 #include "imap_private.h"
36 /* imap_auth_gss: AUTH=GSSAPI support. */
37 imap_auth_res_t imap_auth_gss (IMAP_DATA * idata, const char *method __attribute__ ((unused)))
39 gss_buffer_desc request_buf, send_token;
40 gss_buffer_t sec_token;
41 gss_name_t target_name;
46 OM_uint32 maj_stat, min_stat;
47 char buf1[GSS_BUFSIZE], buf2[GSS_BUFSIZE], server_conf_flags;
48 unsigned long buf_size;
51 if (!mutt_bit_isset (idata->capabilities, AGSSAPI))
52 return IMAP_AUTH_UNAVAIL;
54 if (mutt_account_getuser (&idata->conn->account))
55 return IMAP_AUTH_FAILURE;
57 /* get an IMAP service ticket for the server */
58 snprintf (buf1, sizeof (buf1), "imap@%s", idata->conn->account.host);
59 request_buf.value = buf1;
60 request_buf.length = m_strlen(buf1) + 1;
61 maj_stat = gss_import_name (&min_stat, &request_buf, gss_nt_service_name,
63 if (maj_stat != GSS_S_COMPLETE) {
64 return IMAP_AUTH_UNAVAIL;
67 /* Acquire initial credentials - without a TGT GSSAPI is UNAVAIL */
68 sec_token = GSS_C_NO_BUFFER;
69 context = GSS_C_NO_CONTEXT;
72 maj_stat = gss_init_sec_context (&min_stat, GSS_C_NO_CREDENTIAL, &context,
73 target_name, GSS_C_NO_OID,
74 GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG, 0,
75 GSS_C_NO_CHANNEL_BINDINGS, sec_token, NULL,
76 &send_token, (unsigned int *) &cflags,
78 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
79 gss_release_name (&min_stat, &target_name);
81 return IMAP_AUTH_UNAVAIL;
85 mutt_message _("Authenticating (GSSAPI)...");
87 imap_cmd_start (idata, "AUTHENTICATE GSSAPI");
89 /* expect a null continuation response ("+") */
91 rc = imap_cmd_step (idata);
92 while (rc == IMAP_CMD_CONTINUE);
94 if (rc != IMAP_CMD_RESPOND) {
95 gss_release_name (&min_stat, &target_name);
99 /* now start the security context initialisation loop... */
100 mutt_to_base64 ((unsigned char *) buf1, send_token.value, send_token.length,
102 gss_release_buffer (&min_stat, &send_token);
103 m_strcat(buf1, sizeof(buf1), "\r\n");
104 mutt_socket_write (idata->conn, buf1);
106 while (maj_stat == GSS_S_CONTINUE_NEEDED) {
107 /* Read server data */
109 rc = imap_cmd_step (idata);
110 while (rc == IMAP_CMD_CONTINUE);
112 if (rc != IMAP_CMD_RESPOND) {
113 gss_release_name (&min_stat, &target_name);
117 request_buf.length = mutt_from_base64 (buf2, idata->cmd.buf + 2);
118 request_buf.value = buf2;
119 sec_token = &request_buf;
121 /* Write client data */
122 maj_stat = gss_init_sec_context (&min_stat, GSS_C_NO_CREDENTIAL, &context,
123 target_name, GSS_C_NO_OID,
124 GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG,
125 0, GSS_C_NO_CHANNEL_BINDINGS, sec_token,
127 (unsigned int *) &cflags, NULL);
128 if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
129 gss_release_name (&min_stat, &target_name);
133 mutt_to_base64 ((unsigned char *) buf1, send_token.value,
134 send_token.length, sizeof (buf1) - 2);
135 gss_release_buffer (&min_stat, &send_token);
136 m_strcat(buf1, sizeof(buf1), "\r\n");
137 mutt_socket_write (idata->conn, buf1);
140 gss_release_name (&min_stat, &target_name);
142 /* get security flags and buffer size */
144 rc = imap_cmd_step (idata);
145 while (rc == IMAP_CMD_CONTINUE);
147 if (rc != IMAP_CMD_RESPOND) {
150 request_buf.length = mutt_from_base64 (buf2, idata->cmd.buf + 2);
151 request_buf.value = buf2;
153 maj_stat = gss_unwrap (&min_stat, context, &request_buf, &send_token,
155 if (maj_stat != GSS_S_COMPLETE) {
156 gss_release_buffer (&min_stat, &send_token);
160 /* first octet is security levels supported. We want NONE */
161 server_conf_flags = ((char *) send_token.value)[0];
162 if (!(((char *) send_token.value)[0] & GSS_AUTH_P_NONE)) {
163 gss_release_buffer (&min_stat, &send_token);
167 /* we don't care about buffer size if we don't wrap content. But here it is */
168 ((char *) send_token.value)[0] = 0;
169 buf_size = ntohl (*((long *) send_token.value));
170 gss_release_buffer (&min_stat, &send_token);
172 /* agree to terms (hack!) */
173 buf_size = htonl (buf_size); /* not relevant without integrity/privacy */
174 memcpy (buf1, &buf_size, 4);
175 buf1[0] = GSS_AUTH_P_NONE;
176 /* server decides if principal can log in as user */
177 strncpy (buf1 + 4, idata->conn->account.user, sizeof (buf1) - 4);
178 request_buf.value = buf1;
179 request_buf.length = 4 + m_strlen(idata->conn->account.user) + 1;
180 maj_stat = gss_wrap (&min_stat, context, 0, GSS_C_QOP_DEFAULT, &request_buf,
181 &cflags, &send_token);
182 if (maj_stat != GSS_S_COMPLETE) {
186 mutt_to_base64 ((unsigned char *) buf1, send_token.value, send_token.length,
188 m_strcat(buf1, sizeof(buf1), "\r\n");
189 mutt_socket_write (idata->conn, buf1);
191 /* Joy of victory or agony of defeat? */
193 rc = imap_cmd_step (idata);
194 while (rc == IMAP_CMD_CONTINUE);
195 if (rc == IMAP_CMD_RESPOND) {
198 if (imap_code (idata->cmd.buf)) {
199 /* flush the security context */
200 maj_stat = gss_delete_sec_context (&min_stat, &context, &send_token);
202 /* send_token may contain a notification to the server to flush
203 * credentials. RFC 1731 doesn't specify what to do, and since this
204 * support is only for authentication, we'll assume the server knows
205 * enough to flush its own credentials */
206 gss_release_buffer (&min_stat, &send_token);
208 return IMAP_AUTH_SUCCESS;
214 mutt_socket_write (idata->conn, "*\r\n");
216 rc = imap_cmd_step (idata);
217 while (rc == IMAP_CMD_CONTINUE);
220 mutt_error _("GSSAPI authentication failed.");
222 return IMAP_AUTH_FAILURE;